63% of U.S. mid-market enterprise IT leaders report having formally assessed whether sensitive company or customer data is being entered into AI tools and implemented controls.

56% of cybersecurity decision-makers are concerned about employees inadvertently exposing sensitive information to AI systems.

67% of U.S. cybersecurity decision-makers are concerned about employees inadvertently exposing sensitive information to AI systems.

Around one in seven businesses (14%) and one in five charities (22%) said they held personal data that was not protected by techniques such as anonymisation or encryption, suggesting that the majority do protect personal data (77% of businesses and 69% of charities).

68% of organizations report that less than 80% of their unstructured data is protected.

58% of US IT and security professionals at companies with at least 1,000 employees have adopted Zero Trust principles.

43% of respondents from CNI organisations said data protection and privacy is the biggest security challenge in 2026.

58% of US IT and security professionals at companies with at least 1,000 employees use immutable backup storage across all their data.

72% of large U.S. companies identify attacks on legacy data as the greatest quantum security risk.

48% of enterprise leaders are not fully confident they could demonstrate compliance with data protection regulations.

70% of enterprise leaders use real-time alerts to secure data.

Only 52% of enterprise leaders feel very confident about the security of data travelling across their own networks.

The number of organizations implementing real-time controls on data sent to personal applications increased from 70% to 77% from the previous year.

41% of IT leaders believe increased executive-level accountability would have a major impact on improving cybersecurity and data protection.

54% of IT leaders plan for a moderate or significant increase in their budget for data protection and resilience in 2026.

44% of U.S.-based cybersecurity decision-makers ranked protecting sensitive data among their top two cybersecurity priorities for 2026.

88% of IT leaders believe it will be extremely (50%) or moderately important (38%) in 2026 to ensure partners and suppliers meet their cybersecurity and data protection standards.

30% of businesses reported that they use AI and must now protect it like any other critical system.

77% of organizations are more likely to consider Confidential Computing due to the Digital Operational Resilience Act's specific requirement to protect data in use.

26% of organizations place the insider risk function within a dedicated Data Protection or Data Security team.